@syntax-syllogism/warden-core 0.2.0

package/lib/access/targetValidation.js

@@ -0,0 +1,110 @@
+import { esc, queryAll } from './soql.js';
+import { UserAccessError } from './types.js';
+const setupEntityDefinitions = {
+    'apex-class': { objectName: 'ApexClass', nameField: 'Name', notFoundCode: 'errorApexClassNotFound' },
+    'vf-page': { objectName: 'ApexPage', nameField: 'Name', notFoundCode: 'errorVisualforcePageNotFound' },
+    'custom-permission': {
+        objectName: 'CustomPermission',
+        nameField: 'DeveloperName',
+        notFoundCode: 'errorCustomPermissionNotFound',
+    },
+};
+const describeObject = async (conn, sobjectType) => {
+    try {
+        return (await conn.describe(sobjectType));
+    }
+    catch (error) {
+        throw new UserAccessError('errorObjectNotFound', [sobjectType], error);
+    }
+};
+export const validateObjectTarget = async (conn, target) => {
+    const trimmed = target.trim();
+    if (!trimmed)
+        throw new UserAccessError('errorInvalidTarget', [target]);
+    const describe = await describeObject(conn, trimmed);
+    return { type: 'object', targetName: describe.name, sobjectType: describe.name };
+};
+export const validateFieldTarget = async (conn, target) => {
+    const trimmed = target.trim();
+    const parts = trimmed.split('.');
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+        throw new UserAccessError('errorFieldTargetMustBeQualified', [target]);
+    }
+    const [inputObjectApiName, inputFieldApiName] = parts;
+    const describe = await describeObject(conn, inputObjectApiName);
+    const fieldMap = new Map();
+    for (const field of describe.fields)
+        fieldMap.set(field.name.toLowerCase(), field.name);
+    const canonicalFieldApiName = fieldMap.get(inputFieldApiName.toLowerCase());
+    if (!canonicalFieldApiName) {
+        throw new UserAccessError('errorFieldNotFound', [inputObjectApiName, inputFieldApiName]);
+    }
+    return {
+        type: 'field',
+        targetName: `${describe.name}.${canonicalFieldApiName}`,
+        sobjectType: describe.name,
+        fieldApiName: canonicalFieldApiName,
+    };
+};
+export const validateSetupEntityTarget = async (conn, type, target) => {
+    const trimmed = target.trim();
+    if (!trimmed)
+        throw new UserAccessError('errorInvalidTarget', [target]);
+    const definition = setupEntityDefinitions[type];
+    const rows = await queryAll(conn, `SELECT Id, ${definition.nameField} FROM ${definition.objectName} WHERE ${definition.nameField} = '${esc(trimmed)}' LIMIT 1`);
+    const row = rows[0];
+    if (!row)
+        throw new UserAccessError(definition.notFoundCode, [trimmed]);
+    return {
+        type,
+        targetName: row[definition.nameField] ?? trimmed,
+        setupEntityId: row.Id,
+    };
+};
+export const validateTabTarget = async (conn, target) => {
+    const trimmed = target.trim();
+    if (!trimmed)
+        throw new UserAccessError('errorInvalidTarget', [target]);
+    const rows = await queryAll(conn, `SELECT DurableId, Name FROM TabDefinition WHERE DurableId = '${esc(trimmed)}' LIMIT 1`);
+    if (!rows[0])
+        throw new UserAccessError('errorTabNotFound', [trimmed]);
+    return { type: 'tab', targetName: rows[0].DurableId ?? trimmed };
+};
+export const validateRecordTypeTarget = async (conn, target) => {
+    const trimmed = target.trim();
+    const parts = trimmed.split('.');
+    if (!trimmed ||
+        (trimmed.startsWith('012') && !trimmed.includes('.')) ||
+        parts.length !== 2 ||
+        parts.some((part) => !part)) {
+        throw new UserAccessError('errorRecordTypeTargetMustBeQualified', [target]);
+    }
+    const [inputSobjectType, inputDeveloperName] = parts;
+    if (inputDeveloperName.toLowerCase() === 'master') {
+        throw new UserAccessError('errorMasterRecordTypeUnsupported', [trimmed]);
+    }
+    const rows = await queryAll(conn, [
+        'SELECT Id, SobjectType, DeveloperName, Name, IsActive',
+        'FROM RecordType',
+        `WHERE SobjectType = '${esc(inputSobjectType)}'`,
+        `AND DeveloperName = '${esc(inputDeveloperName)}'`,
+        'LIMIT 2',
+    ].join(' '));
+    if (rows.length === 0)
+        throw new UserAccessError('errorRecordTypeNotFound', [trimmed]);
+    if (rows.length > 1)
+        throw new UserAccessError('errorRecordTypeAmbiguous', [trimmed]);
+    const row = rows[0];
+    if (row.IsActive !== true)
+        throw new UserAccessError('errorRecordTypeInactive', [trimmed]);
+    if (!row.SobjectType || !row.DeveloperName || !row.Id) {
+        throw new UserAccessError('errorRecordTypeNotFound', [trimmed]);
+    }
+    return {
+        type: 'record-type',
+        targetName: `${row.SobjectType}.${row.DeveloperName}`,
+        sobjectType: row.SobjectType,
+        recordTypeId: row.Id,
+    };
+};
+//# sourceMappingURL=targetValidation.js.map

package/lib/access/targetValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"targetValidation.js","sourceRoot":"","sources":["../../src/access/targetValidation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAA8B,MAAM,YAAY,CAAC;AAmBzE,MAAM,sBAAsB,GAA0C;IACpE,YAAY,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,wBAAwB,EAAE;IACpG,SAAS,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,8BAA8B,EAAE;IACtG,mBAAmB,EAAE;QACnB,UAAU,EAAE,kBAAkB;QAC9B,SAAS,EAAE,eAAe;QAC1B,YAAY,EAAE,+BAA+B;KAC9C;CACF,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAAE,IAAgB,EAAE,WAAmB,EAA4B,EAAE;IAC/F,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAoB,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAAgB,EAAE,MAAc,EAAkC,EAAE;IAC7G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,IAAgB,EAAE,MAAc,EAAkC,EAAE;IAC5G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxF,MAAM,qBAAqB,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,qBAAqB,EAAE;QACvD,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,YAAY,EAAE,qBAAqB;KACpC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,IAAgB,EAChB,IAAoD,EACpD,MAAc,EACkB,EAAE;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,EACJ,cAAc,UAAU,CAAC,SAAS,SAAS,UAAU,CAAC,UAAU,UAAU,UAAU,CAAC,SAAS,OAAO,GAAG,CACtG,OAAO,CACR,WAAW,CACb,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO;QAChD,aAAa,EAAE,GAAG,CAAC,EAAE;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAAgB,EAAE,MAAc,EAAkC,EAAE;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,EACJ,gEAAgE,GAAG,CAAC,OAAO,CAAC,WAAW,CACxF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,IAAgB,EAAE,MAAc,EAAkC,EAAE;IACjH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IACE,CAAC,OAAO;QACR,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrD,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAC3B,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,GAAG,KAAK,CAAC;IACrD,IAAI,kBAAkB,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,EACJ;QACE,uDAAuD;QACvD,iBAAiB;QACjB,wBAAwB,GAAG,CAAC,gBAAgB,CAAC,GAAG;QAChD,wBAAwB,GAAG,CAAC,kBAAkB,CAAC,GAAG;QAClD,SAAS;KACV,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,aAAa,EAAE;QACrD,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,YAAY,EAAE,GAAG,CAAC,EAAE;KACrB,CAAC;AACJ,CAAC,CAAC"}

package/lib/access/types.d.ts

@@ -0,0 +1,88 @@
+import type { Connection } from '@salesforce/core';
+import { WardenError } from '../errors.js';
+export type AccessTargetType = 'field' | 'object' | 'apex-class' | 'vf-page' | 'custom-permission' | 'tab' | 'record-type';
+export type AssignmentType = 'Profile' | 'PermissionSet' | 'PermissionSetGroup';
+export type FieldAccess = {
+    kind: 'field';
+    read: boolean;
+    edit: boolean;
+};
+export type ObjectAccess = {
+    kind: 'object';
+    read: boolean;
+    create: boolean;
+    edit: boolean;
+    delete: boolean;
+    viewAll: boolean;
+    modifyAll: boolean;
+};
+export type EnabledAccess = {
+    kind: 'enabled';
+    enabled: boolean;
+};
+export type TabAccess = {
+    kind: 'tab';
+    visibility: string;
+};
+export type RecordTypeAccess = {
+    kind: 'record-type';
+    visible: boolean;
+    default: boolean | null;
+};
+export type UserAccessRow = {
+    userId: string;
+    userName: string;
+    username: string;
+    targetType: AccessTargetType;
+    targetName: string;
+    assignmentType: AssignmentType;
+    sourceId: string;
+    sourceName: string;
+    sourceApiName?: string;
+    sourceLabel?: string;
+    viaPermissionSetId?: string;
+    viaPermissionSetName?: string;
+    access: FieldAccess | ObjectAccess | EnabledAccess | TabAccess | RecordTypeAccess;
+};
+export type UserAccessStats = {
+    totalActiveUsersWithAccess: number;
+    profileGrants: number;
+    permissionSetGrants: number;
+    permissionSetGroupGrants: number;
+};
+export type UserAccessResult = {
+    targetType: AccessTargetType;
+    targetName: string;
+    sobjectType?: string;
+    fieldApiName?: string;
+    rows: UserAccessRow[];
+    stats: UserAccessStats;
+    warnings: string[];
+};
+export type ValidatedAccessTarget = {
+    type: AccessTargetType;
+    targetName: string;
+    sobjectType?: string;
+    fieldApiName?: string;
+    setupEntityId?: string;
+    recordTypeId?: string;
+};
+export type AccessTargetResolver = {
+    type: AccessTargetType;
+    validateTarget(conn: Connection, target: string): Promise<ValidatedAccessTarget>;
+    resolve(conn: Connection, target: ValidatedAccessTarget): Promise<UserAccessResult>;
+    csvColumns(): string[];
+};
+export type AccessErrorCode = 'errorUnsupportedAccessType' | 'errorInvalidTarget' | 'errorFieldTargetMustBeQualified' | 'errorObjectNotFound' | 'errorFieldNotFound' | 'errorApexClassNotFound' | 'errorVisualforcePageNotFound' | 'errorCustomPermissionNotFound' | 'errorTabNotFound' | 'errorRecordTypeTargetMustBeQualified' | 'errorMasterRecordTypeUnsupported' | 'errorRecordTypeNotFound' | 'errorRecordTypeAmbiguous' | 'errorRecordTypeInactive' | 'errorRecordTypeMetadataReadFailed' | 'errorAccessQueryFailed';
+export declare class AccessError extends WardenError<AccessErrorCode, {
+    args: string[];
+    cause?: unknown;
+}> {
+    readonly args: string[];
+    readonly cause?: unknown;
+    constructor(code: AccessErrorCode, args?: string[], cause?: unknown);
+}
+/** Backward-compatible name retained for callers of the extracted modules. */
+export declare class UserAccessError extends AccessError {
+    constructor(code: AccessErrorCode, args?: string[], cause?: unknown);
+}

package/lib/access/types.js

@@ -0,0 +1,20 @@
+import { WardenError } from '../errors.js';
+import { accessMessage } from './messages.js';
+export class AccessError extends WardenError {
+    args;
+    cause;
+    constructor(code, args = [], cause) {
+        super(code, accessMessage(code, args), { args, cause });
+        this.name = 'AccessError';
+        this.args = args;
+        this.cause = cause;
+    }
+}
+/** Backward-compatible name retained for callers of the extracted modules. */
+export class UserAccessError extends AccessError {
+    constructor(code, args = [], cause) {
+        super(code, args, cause);
+        this.name = 'UserAccessError';
+    }
+}
+//# sourceMappingURL=types.js.map

package/lib/access/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AA+G9C,MAAM,OAAO,WAAY,SAAQ,WAAiE;IAChF,IAAI,CAAW;IACf,KAAK,CAAW;IAEhC,YAAmB,IAAqB,EAAE,OAAiB,EAAE,EAAE,KAAe;QAC5E,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,eAAgB,SAAQ,WAAW;IAC9C,YAAmB,IAAqB,EAAE,OAAiB,EAAE,EAAE,KAAe;QAC5E,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}

package/lib/errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Base error for everything warden-core throws on purpose.
+ *
+ * `code` and the shape of `data` are part of the public API and are
+ * semver-covered; `message` is default English text that callers may show
+ * as is or replace using `code`. Area-specific subclasses narrow `C` to a
+ * string-literal union of their codes.
+ */
+export declare class WardenError<C extends string = string, D = unknown> extends Error {
+    readonly code: C;
+    readonly data?: D | undefined;
+    constructor(code: C, message: string, data?: D | undefined);
+}
+/**
+ * Structural check for {@link WardenError}. Prefer this over `instanceof`,
+ * which fails when a consumer ends up with two copies of this package.
+ */
+export declare const isWardenError: (error: unknown) => error is WardenError;

package/lib/errors.js

@@ -0,0 +1,39 @@
+/**
+ * Base error for everything warden-core throws on purpose.
+ *
+ * `code` and the shape of `data` are part of the public API and are
+ * semver-covered; `message` is default English text that callers may show
+ * as is or replace using `code`. Area-specific subclasses narrow `C` to a
+ * string-literal union of their codes.
+ */
+export class WardenError extends Error {
+    code;
+    data;
+    constructor(code, message, data) {
+        super(message);
+        this.code = code;
+        this.data = data;
+        this.name = 'WardenError';
+    }
+}
+const WARDEN_ERROR_NAMES = new Set([
+    'WardenError',
+    'AccessError',
+    'UserAccessError',
+    'LifecycleError',
+    'ProvisioningError',
+    'DefinitionError',
+    'CsvReadError',
+    'RelatedRecordsError',
+]);
+/**
+ * Structural check for {@link WardenError}. Prefer this over `instanceof`,
+ * which fails when a consumer ends up with two copies of this package.
+ */
+export const isWardenError = (error) => error instanceof WardenError ||
+    (typeof error === 'object' &&
+        error !== null &&
+        WARDEN_ERROR_NAMES.has(typeof error.name === 'string' ? error.name : '') &&
+        typeof error.code === 'string' &&
+        typeof error.message === 'string');
+//# sourceMappingURL=errors.js.map

package/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,OAAO,WAAoD,SAAQ,KAAK;IACzC;IAA0C;IAA7E,YAAmC,IAAO,EAAE,OAAe,EAAkB,IAAQ;QACnF,KAAK,CAAC,OAAO,CAAC,CAAC;QADkB,SAAI,GAAJ,IAAI,CAAG;QAAmC,SAAI,GAAJ,IAAI,CAAI;QAEnF,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,aAAa;IACb,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,iBAAiB;IACjB,cAAc;IACd,qBAAqB;CACtB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAc,EAAwB,EAAE,CACpE,KAAK,YAAY,WAAW;IAC5B,CAAC,OAAO,KAAK,KAAK,QAAQ;QACxB,KAAK,KAAK,IAAI;QACd,kBAAkB,CAAC,GAAG,CACpB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,KAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/F;QACD,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACtD,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,37 @@
+export { WardenError, isWardenError } from './errors.js';
+export { AccessError, UserAccessError } from './access/types.js';
+export { flattenAccessRow, renderEnabledTable, renderFieldTable, renderObjectTable, renderRecordTypeTable, renderTabTable, } from './access/output.js';
+export { getResolver } from './access/resolvers/index.js';
+export { resolveReverseAccess, reverseCsvColumns } from './access/reverse.js';
+export { LifecycleError } from './lifecycle/errors.js';
+export { executeFreezeToggle, FREEZE, UNFREEZE } from './lifecycle/freezeState.js';
+export { failedResult, makeNotice, renderLifecycleResult, resolvedTargetResult, summarizeLifecycle, } from './lifecycle/output.js';
+export { executeStrip } from './lifecycle/stripPlan.js';
+export { buildSnapshotFile, readSnapshotFile, writeSnapshotFile } from './lifecycle/snapshotState.js';
+export { buildTargetRequests, parseUserFlag, resolveTargetField, resolveTargets } from './lifecycle/targeting.js';
+export { executePersonaDiff, executeUserToUserDiff } from './lifecycle/userDiff.js';
+export { renderUserDiffCsv, renderUserDiffHuman } from './lifecycle/diffOutput.js';
+export { renderUserConformanceCsv, renderUserConformanceHuman, verifyUserDiff } from './lifecycle/conformance.js';
+export { loadAssignmentState } from './lifecycle/assignmentState.js';
+export { runAssignmentCreates, runRecordUpdate } from './lifecycle/dmlRunner.js';
+export { ProvisioningError, DefinitionError } from './provisioning/errors.js';
+export { ProvisionUserUseCase } from './provisioning/provisionUserUseCase.js';
+export { readProvisionDefinitions } from './provisioning/definitionReader.js';
+export { RelatedRecordsError } from './relatedRecords/errors.js';
+export { personaDefinitionsFileSchema, personaSchema, relatedCatalogSchema, relationshipDefSchema, snapshotFileSchema, userInputSchema, userSnapshotEntrySchema, usersDefinitionFileSchema, USERS_CSV_COLUMNS, } from './spec/index.js';
+export { parsePersonaDefinitions, parseRelatedCatalog, parseSnapshot, parseUsersDefinition, safeParsePersonaDefinitions, safeParseRelatedCatalog, safeParseSnapshot, safeParseUsersDefinition, validatePersonaDefinitionsText, validateRelatedCatalogText, validateSnapshotText, validateUsersDefinitionText, } from './spec/index.js';
+export { confirmWithTimeout } from './shared/prompt.js';
+export { detectInputFormat, serializeCsv } from './shared/csv.js';
+export { describeUserFields } from './shared/userFields.js';
+export { renderLifecycleCsv, renderProvisionCsv, renderRestoreCsv, renderSnapshotCsv, renderStripCsv, } from './shared/output.js';
+export { soqlIn } from './shared/sfUtils.js';
+export type { InputFormat } from './shared/csv.js';
+export type { AccessTargetType, UserAccessResult, UserAccessRow, ValidatedAccessTarget } from './access/types.js';
+export type { AssignmentState } from './lifecycle/assignmentState.js';
+export type { IdentityReview, LabelBundle, LifecycleResult, LifecycleUserResult, ResolvedTargetUser, TargetRequest, } from './lifecycle/types.js';
+export type { ProvisionResult } from './provisioning/provisionUserUseCase.js';
+export type { StripFlags } from './lifecycle/stripPlan.js';
+export type { UserDiffResult } from './lifecycle/userDiff.js';
+export type { UserConformanceVerdict } from './lifecycle/conformance.js';
+export type { UserSnapshotEntry } from './lifecycle/snapshotState.js';
+export type { PersonaDefinition, PersonaDefinitionsFile, RelatedCatalog, RelationshipDef, RelationshipMode, RelationshipPhase, SchemaFailure, SchemaIssue, SchemaResult, SchemaSuccess, SourceExpr, UserInput, UserSnapshotFile, UsersDefinitionFile, } from './spec/index.js';

package/lib/index.js

@@ -0,0 +1,33 @@
+// Everything exported from this file is warden-core's public API and is
+// semver-covered: adding an export is a minor change, but removing or renaming
+// one, or changing a signature or result shape, is breaking.
+// `test/index.test.ts` pins the exported-key list so an accidental removal
+// fails a test instead of shipping. See docs/design/0001-warden-core-boundaries.md.
+export { WardenError, isWardenError } from './errors.js';
+export { AccessError, UserAccessError } from './access/types.js';
+export { flattenAccessRow, renderEnabledTable, renderFieldTable, renderObjectTable, renderRecordTypeTable, renderTabTable, } from './access/output.js';
+export { getResolver } from './access/resolvers/index.js';
+export { resolveReverseAccess, reverseCsvColumns } from './access/reverse.js';
+export { LifecycleError } from './lifecycle/errors.js';
+export { executeFreezeToggle, FREEZE, UNFREEZE } from './lifecycle/freezeState.js';
+export { failedResult, makeNotice, renderLifecycleResult, resolvedTargetResult, summarizeLifecycle, } from './lifecycle/output.js';
+export { executeStrip } from './lifecycle/stripPlan.js';
+export { buildSnapshotFile, readSnapshotFile, writeSnapshotFile } from './lifecycle/snapshotState.js';
+export { buildTargetRequests, parseUserFlag, resolveTargetField, resolveTargets } from './lifecycle/targeting.js';
+export { executePersonaDiff, executeUserToUserDiff } from './lifecycle/userDiff.js';
+export { renderUserDiffCsv, renderUserDiffHuman } from './lifecycle/diffOutput.js';
+export { renderUserConformanceCsv, renderUserConformanceHuman, verifyUserDiff } from './lifecycle/conformance.js';
+export { loadAssignmentState } from './lifecycle/assignmentState.js';
+export { runAssignmentCreates, runRecordUpdate } from './lifecycle/dmlRunner.js';
+export { ProvisioningError, DefinitionError } from './provisioning/errors.js';
+export { ProvisionUserUseCase } from './provisioning/provisionUserUseCase.js';
+export { readProvisionDefinitions } from './provisioning/definitionReader.js';
+export { RelatedRecordsError } from './relatedRecords/errors.js';
+export { personaDefinitionsFileSchema, personaSchema, relatedCatalogSchema, relationshipDefSchema, snapshotFileSchema, userInputSchema, userSnapshotEntrySchema, usersDefinitionFileSchema, USERS_CSV_COLUMNS, } from './spec/index.js';
+export { parsePersonaDefinitions, parseRelatedCatalog, parseSnapshot, parseUsersDefinition, safeParsePersonaDefinitions, safeParseRelatedCatalog, safeParseSnapshot, safeParseUsersDefinition, validatePersonaDefinitionsText, validateRelatedCatalogText, validateSnapshotText, validateUsersDefinitionText, } from './spec/index.js';
+export { confirmWithTimeout } from './shared/prompt.js';
+export { detectInputFormat, serializeCsv } from './shared/csv.js';
+export { describeUserFields } from './shared/userFields.js';
+export { renderLifecycleCsv, renderProvisionCsv, renderRestoreCsv, renderSnapshotCsv, renderStripCsv, } from './shared/output.js';
+export { soqlIn } from './shared/sfUtils.js';
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,+EAA+E;AAC/E,6DAA6D;AAC7D,2EAA2E;AAC3E,oFAAoF;AAEpF,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EACL,YAAY,EACZ,UAAU,EACV,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAClH,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEjF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,wBAAwB,EACxB,8BAA8B,EAC9B,0BAA0B,EAC1B,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC"}

package/lib/lifecycle/assignmentState.d.ts

@@ -0,0 +1,62 @@
+import type { Connection } from '@salesforce/core';
+import type { LabelBundle } from './types.js';
+export type UserLoginRow = {
+    Id: string;
+    UserId: string;
+    IsFrozen: boolean;
+};
+export type PermissionSetAssignmentRow = {
+    Id: string;
+    AssigneeId: string;
+    PermissionSetId?: string | null;
+    PermissionSetGroupId?: string | null;
+    PermissionSet?: {
+        IsOwnedByProfile?: boolean;
+        Name?: string;
+        Label?: string;
+    } | null;
+    PermissionSetGroup?: {
+        DeveloperName?: string;
+        MasterLabel?: string;
+    } | null;
+};
+export type GroupMemberRow = {
+    Id: string;
+    GroupId: string;
+    UserOrGroupId: string;
+    Group?: {
+        Type?: string;
+        DeveloperName?: string;
+        Name?: string;
+    } | null;
+};
+export type PermissionSetLicenseAssignRow = {
+    Id: string;
+    AssigneeId: string;
+    PermissionSetLicenseId: string;
+    PermissionSetLicense?: {
+        DeveloperName?: string;
+        MasterLabel?: string;
+    } | null;
+};
+/**
+ * Describe a permission set assignment by its group when it came from one,
+ * otherwise by the permission set itself. Rows identifying neither assignment
+ * type are ignored; loadAssignmentState's query always projects PermissionSetId.
+ */
+export declare const permissionSetAssignmentLabel: (row: PermissionSetAssignmentRow) => LabelBundle | undefined;
+export declare const groupMemberLabel: (row: GroupMemberRow) => LabelBundle;
+export declare const permissionSetLicenseLabel: (row: PermissionSetLicenseAssignRow) => LabelBundle;
+export type AssignmentState = {
+    userLoginByUserId: Map<string, UserLoginRow[]>;
+    psaByUserId: Map<string, PermissionSetAssignmentRow[]>;
+    groupByUserId: Map<string, GroupMemberRow[]>;
+    pslByUserId: Map<string, PermissionSetLicenseAssignRow[]>;
+};
+export type AssignmentStateOptions = {
+    userLogin?: boolean;
+    permissionSetAssignments?: boolean;
+    groupMemberships?: boolean;
+    permissionSetLicenses?: boolean;
+};
+export declare const loadAssignmentState: (conn: Connection, targetIds: string[], options?: AssignmentStateOptions) => Promise<AssignmentState>;

package/lib/lifecycle/assignmentState.js

@@ -0,0 +1,89 @@
+import { batch, soqlIn } from '../shared/sfUtils.js';
+/**
+ * Describe a permission set assignment by its group when it came from one,
+ * otherwise by the permission set itself. Rows identifying neither assignment
+ * type are ignored; loadAssignmentState's query always projects PermissionSetId.
+ */
+export const permissionSetAssignmentLabel = (row) => {
+    if (row.PermissionSetGroupId) {
+        return {
+            id: row.PermissionSetGroupId,
+            apiName: row.PermissionSetGroup?.DeveloperName,
+            label: row.PermissionSetGroup?.MasterLabel,
+            type: 'PermissionSetGroup',
+        };
+    }
+    if (row.PermissionSetId) {
+        return {
+            id: row.PermissionSetId,
+            apiName: row.PermissionSet?.Name,
+            label: row.PermissionSet?.Label,
+            type: 'PermissionSet',
+        };
+    }
+    return undefined;
+};
+export const groupMemberLabel = (row) => ({
+    id: row.GroupId,
+    apiName: row.Group?.DeveloperName,
+    label: row.Group?.Name,
+    type: row.Group?.Type === 'Queue' ? 'Queue' : 'PublicGroup',
+});
+export const permissionSetLicenseLabel = (row) => ({
+    id: row.PermissionSetLicenseId,
+    apiName: row.PermissionSetLicense?.DeveloperName,
+    label: row.PermissionSetLicense?.MasterLabel,
+    type: 'PermissionSetLicense',
+});
+const QUERY_BATCH_SIZE = 100;
+const emptyState = () => ({
+    userLoginByUserId: new Map(),
+    psaByUserId: new Map(),
+    groupByUserId: new Map(),
+    pslByUserId: new Map(),
+});
+const queryRowsByUser = async (conn, soql, keyField) => {
+    const rows = (await conn.query(soql)).records;
+    const map = new Map();
+    for (const row of rows) {
+        const key = String(row[keyField] ?? '');
+        const group = map.get(key) ?? [];
+        group.push(row);
+        map.set(key, group);
+    }
+    return map;
+};
+const mergeMaps = (maps) => {
+    const merged = new Map();
+    for (const map of maps) {
+        for (const [key, rows] of map.entries()) {
+            merged.set(key, (merged.get(key) ?? []).concat(rows));
+        }
+    }
+    return merged;
+};
+const queryRowsByUserBatched = async (conn, targetIds, buildSoql, keyField) => {
+    const maps = await Promise.all(batch(targetIds, QUERY_BATCH_SIZE).map((idBatch) => queryRowsByUser(conn, buildSoql(soqlIn(idBatch)), keyField)));
+    return mergeMaps(maps);
+};
+const shouldLoad = (options, key) => options ? options[key] === true : true;
+export const loadAssignmentState = async (conn, targetIds, options) => {
+    if (targetIds.length === 0)
+        return emptyState();
+    const [userLoginByUserId, psaByUserId, groupByUserId, pslByUserId] = await Promise.all([
+        shouldLoad(options, 'userLogin')
+            ? queryRowsByUserBatched(conn, targetIds, (inClause) => `SELECT Id, UserId, IsFrozen FROM UserLogin WHERE UserId IN (${inClause})`, 'UserId')
+            : Promise.resolve(new Map()),
+        shouldLoad(options, 'permissionSetAssignments')
+            ? queryRowsByUserBatched(conn, targetIds, (inClause) => `SELECT Id, AssigneeId, PermissionSetId, PermissionSetGroupId, PermissionSet.IsOwnedByProfile, PermissionSet.Name, PermissionSet.Label, PermissionSetGroup.DeveloperName, PermissionSetGroup.MasterLabel FROM PermissionSetAssignment WHERE AssigneeId IN (${inClause})`, 'AssigneeId')
+            : Promise.resolve(new Map()),
+        shouldLoad(options, 'groupMemberships')
+            ? queryRowsByUserBatched(conn, targetIds, (inClause) => `SELECT Id, GroupId, UserOrGroupId, Group.Type, Group.DeveloperName, Group.Name FROM GroupMember WHERE UserOrGroupId IN (${inClause}) AND Group.Type IN ('Regular', 'Queue')`, 'UserOrGroupId')
+            : Promise.resolve(new Map()),
+        shouldLoad(options, 'permissionSetLicenses')
+            ? queryRowsByUserBatched(conn, targetIds, (inClause) => `SELECT Id, AssigneeId, PermissionSetLicenseId, PermissionSetLicense.DeveloperName, PermissionSetLicense.MasterLabel FROM PermissionSetLicenseAssign WHERE AssigneeId IN (${inClause})`, 'AssigneeId')
+            : Promise.resolve(new Map()),
+    ]);
+    return { userLoginByUserId, psaByUserId, groupByUserId, pslByUserId };
+};
+//# sourceMappingURL=assignmentState.js.map

package/lib/lifecycle/assignmentState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignmentState.js","sourceRoot":"","sources":["../../src/lifecycle/assignmentState.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAgCrD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAA+B,EAA2B,EAAE;IACvG,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,oBAAoB;YAC5B,OAAO,EAAE,GAAG,CAAC,kBAAkB,EAAE,aAAa;YAC9C,KAAK,EAAE,GAAG,CAAC,kBAAkB,EAAE,WAAW;YAC1C,IAAI,EAAE,oBAAoB;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,eAAe;YACvB,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI;YAChC,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,KAAK;YAC/B,IAAI,EAAE,eAAe;SACtB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAmB,EAAe,EAAE,CAAC,CAAC;IACrE,EAAE,EAAE,GAAG,CAAC,OAAO;IACf,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa;IACjC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI;IACtB,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;CAC5D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAkC,EAAe,EAAE,CAAC,CAAC;IAC7F,EAAE,EAAE,GAAG,CAAC,sBAAsB;IAC9B,OAAO,EAAE,GAAG,CAAC,oBAAoB,EAAE,aAAa;IAChD,KAAK,EAAE,GAAG,CAAC,oBAAoB,EAAE,WAAW;IAC5C,IAAI,EAAE,sBAAsB;CAC7B,CAAC,CAAC;AAgBH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,UAAU,GAAG,GAAoB,EAAE,CAAC,CAAC;IACzC,iBAAiB,EAAE,IAAI,GAAG,EAA0B;IACpD,WAAW,EAAE,IAAI,GAAG,EAAwC;IAC5D,aAAa,EAAE,IAAI,GAAG,EAA4B;IAClD,WAAW,EAAE,IAAI,GAAG,EAA2C;CAChE,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,KAAK,EAC3B,IAA+B,EAC/B,IAAY,EACZ,QAAgB,EACW,EAAE;IAC7B,MAAM,IAAI,GAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAiC,CAAC,OAAO,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAe,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAI,IAA6B,EAAoB,EAAE;IACvE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,KAAK,EAClC,IAA+B,EAC/B,SAAmB,EACnB,SAAuC,EACvC,QAAgB,EACW,EAAE;IAC7B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAI,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CACpH,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,OAA2C,EAAE,GAAiC,EAAW,EAAE,CAC7G,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAEzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,IAAgB,EAChB,SAAmB,EACnB,OAAgC,EACN,EAAE;IAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAEhD,MAAM,CAAC,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrF,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC;YAC9B,CAAC,CAAC,sBAAsB,CACpB,IAAI,EACJ,SAAS,EACT,CAAC,QAAQ,EAAE,EAAE,CAAC,+DAA+D,QAAQ,GAAG,EACxF,QAAQ,CACT;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAA0B,CAAC;QACtD,UAAU,CAAC,OAAO,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,sBAAsB,CACpB,IAAI,EACJ,SAAS,EACT,CAAC,QAAQ,EAAE,EAAE,CACX,6PAA6P,QAAQ,GAAG,EAC1Q,YAAY,CACb;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAAwC,CAAC;QACpE,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC;YACrC,CAAC,CAAC,sBAAsB,CACpB,IAAI,EACJ,SAAS,EACT,CAAC,QAAQ,EAAE,EAAE,CACX,2HAA2H,QAAQ,0CAA0C,EAC/K,eAAe,CAChB;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAA4B,CAAC;QACxD,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;YAC1C,CAAC,CAAC,sBAAsB,CACpB,IAAI,EACJ,SAAS,EACT,CAAC,QAAQ,EAAE,EAAE,CACX,4KAA4K,QAAQ,GAAG,EACzL,YAAY,CACb;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAA2C,CAAC;KACxE,CAAC,CAAC;IAEH,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AACxE,CAAC,CAAC"}

package/lib/lifecycle/conformance.d.ts

@@ -0,0 +1,10 @@
+import type { UserDiffResult } from './userDiff.js';
+import { type MessageLookup } from './diffOutput.js';
+export type UserConformanceVerdict = {
+    key: string;
+    conformant: boolean;
+    violations: string[];
+};
+export declare const verifyUserDiff: (result: UserDiffResult, lookup: MessageLookup) => UserConformanceVerdict[];
+export declare const renderUserConformanceCsv: (verdicts: UserConformanceVerdict[]) => string;
+export declare const renderUserConformanceHuman: (verdicts: UserConformanceVerdict[], lookup: MessageLookup) => string;

package/lib/lifecycle/conformance.js

@@ -0,0 +1,59 @@
+import { serializeCsv } from '../shared/csv.js';
+import { displayValue } from './diffOutput.js';
+const conformanceViolationsForCategory = (result, category, delta, lookup) => {
+    const violations = [];
+    if (delta.adds.length > 0) {
+        violations.push(lookup('verify.violation.missing', [category, delta.adds.map((value) => displayValue(result, value)).join(', ')]));
+    }
+    if (delta.mode === 'sync' && delta.removes.length > 0) {
+        violations.push(lookup('verify.violation.extra', [category, delta.removes.map((value) => displayValue(result, value)).join(', ')]));
+    }
+    return violations;
+};
+const conformanceViolationsForUser = (result, user, lookup) => {
+    if (user.status === 'would-create')
+        return [lookup('verify.violation.notFound')];
+    if (user.status === 'failed') {
+        return user.errors.length > 0
+            ? user.errors.map((error) => lookup('verify.violation.error', [error]))
+            : [lookup('verify.violation.error', ['user diff failed'])];
+    }
+    const violations = [];
+    if (!user.profile.matches) {
+        violations.push(lookup('verify.violation.profile', [
+            displayValue(result, user.profile.current ?? ''),
+            displayValue(result, user.profile.intended ?? ''),
+        ]));
+    }
+    if (!user.role.matches) {
+        violations.push(lookup('verify.violation.role', [
+            displayValue(result, user.role.current ?? ''),
+            displayValue(result, user.role.intended ?? ''),
+        ]));
+    }
+    for (const [category, delta] of Object.entries(user.assignments)) {
+        violations.push(...conformanceViolationsForCategory(result, category, delta, lookup));
+    }
+    return violations;
+};
+export const verifyUserDiff = (result, lookup) => result.users.map((user) => {
+    const violations = conformanceViolationsForUser(result, user, lookup);
+    return { key: user.key, conformant: violations.length === 0, violations };
+});
+export const renderUserConformanceCsv = (verdicts) => serializeCsv(verdicts.map((verdict) => ({
+    key: verdict.key,
+    conformant: String(verdict.conformant),
+    violations: verdict.violations.join('; '),
+})), ['key', 'conformant', 'violations']);
+export const renderUserConformanceHuman = (verdicts, lookup) => {
+    const conformant = verdicts.filter((verdict) => verdict.conformant).length;
+    const nonConformant = verdicts.length - conformant;
+    const lines = [lookup('verify.summary', [String(verdicts.length), String(conformant), String(nonConformant)])];
+    for (const verdict of verdicts.filter((candidate) => !candidate.conformant)) {
+        lines.push('', lookup('verify.user', [verdict.key]));
+        for (const violation of verdict.violations)
+            lines.push(`  - ${violation}`);
+    }
+    return lines.join('\n');
+};
+//# sourceMappingURL=conformance.js.map

package/lib/lifecycle/conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.js","sourceRoot":"","sources":["../../src/lifecycle/conformance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAsB,MAAM,iBAAiB,CAAC;AAQnE,MAAM,gCAAgC,GAAG,CACvC,MAAsB,EACtB,QAA+B,EAC/B,KAA8B,EAC9B,MAAqB,EACX,EAAE;IACZ,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,0BAA0B,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAClH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,wBAAwB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACnH,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,CACnC,MAAsB,EACtB,IAAwB,EACxB,MAAqB,EACX,EAAE;IACZ,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAC3B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,0BAA0B,EAAE;YACjC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAChD,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;SAClD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,uBAAuB,EAAE;YAC9B,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YAC7C,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC/C,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAE9D,EAAE,CAAC;QACF,UAAU,CAAC,IAAI,CAAC,GAAG,gCAAgC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAsB,EAAE,MAAqB,EAA4B,EAAE,CACxG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;IACxB,MAAM,UAAU,GAAG,4BAA4B,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,QAAkC,EAAU,EAAE,CACrF,YAAY,CACV,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzB,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;IACtC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;CAC1C,CAAC,CAAC,EACH,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CACpC,CAAC;AAEJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,QAAkC,EAAE,MAAqB,EAAU,EAAE;IAC9G,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC3E,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5E,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC"}

package/lib/lifecycle/diffOutput.d.ts

@@ -0,0 +1,7 @@
+import type { UserDiffResult } from './userDiff.js';
+export type MessageLookup = (key: string, args?: string[]) => string;
+export declare const renderUserDiffCsv: (result: UserDiffResult) => string;
+export declare const displayValue: (result: UserDiffResult, value: string) => string;
+export declare const renderUserDiffHuman: (result: UserDiffResult, lookup: MessageLookup, options?: {
+    verbose?: boolean;
+}) => string;